200-201 Question 36
Select 3As part of a cybersecurity assessment, a SOC team is performing threat modeling for a new web application that handles sensitive customer data. Which of the following activities should the team prioritize during the threat modeling process to identify potential threats effectively?
- A
Identify and categorize assets based on their value and sensitivity.
- B
Determine the potential adversaries and their motives.
- C
Implement security controls to mitigate identified risks immediately.
- D
Map out data flows and identify entry points for potential attacks.
- E
Monitor network traffic for signs of ongoing attacks.
Show answer and explanation
Correct answers: A, B, D
Explanation
Threat modeling is a systematic approach to identifying, assessing, and addressing potential security threats to an application or system. It involves identifying critical assets, understanding potential adversaries, and analyzing data flows and attack vectors. By focusing on these activities, the SOC team can effectively anticipate and address security risks before implementing mitigation strategies or monitoring for real-time attacks.
- A. Correct.
Correct. Identifying and categorizing assets is a critical step in threat modeling, as it helps determine what needs to be protected and how it could be targeted.
- B. Correct.
Correct. Understanding potential adversaries and their motives allows the team to anticipate likely attack scenarios and focus on relevant threats.
- C. Incorrect.
Incorrect. While implementing security controls is important, this step typically occurs after threats have been identified and prioritized, not during the initial threat modeling process.
- D. Correct.
Correct. Mapping data flows and identifying entry points is a key part of understanding how data is processed, stored, and transmitted, which helps identify vulnerabilities.
- E. Incorrect.
Incorrect. Monitoring network traffic is a part of ongoing threat detection and response, not a core activity during the threat modeling process.